CVE-2017-20248 WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download

HighCVSS 8.7 EPSS 0.64%

Published: 2026-06-09 14:48
Updated: 2026-07-29 20:39
Exploit status: No public exploit known

Description

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.

Affected products

Product	Affected versions	Fixed in
wordpress apptha-slider-gallery(WordPress)	<= 1.0	No fix listed
Apptha Slider Gallery	= 1.0	No fix listed

References

Wordfence Intelligence third-party-advisory
www.cve.org
ExploitDB-41568 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download third-party-advisory

CVSS v4.0

8.7 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: None
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (5)

v4.0 8.7 · vulncheck
v4.0 8.7 · disclosure@vulncheck.com
v3.1 7.5 · vulncheck
v3.1 7.5 · disclosure@vulncheck.com
v3.1 7.5 · wordfence

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.64% (percentile 51.3)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.